linux-fsdevel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 0/3 v3] fs: allow to use dirfd as root for openat and other *at syscalls
@ 2016-07-20 20:42 Andrey Vagin
  2016-07-20 20:42 ` [PATCH 1/3 v2] namei: add LOOKUP_DFD_ROOT to use dfd as root Andrey Vagin
                   ` (2 more replies)
  0 siblings, 3 replies; 5+ messages in thread
From: Andrey Vagin @ 2016-07-20 20:42 UTC (permalink / raw)
  To: linux-fsdevel, Alexander Viro
  Cc: linux-kernel, linux-api, containers, criu, Andrey Vagin,
	Eric W. Biederman, Arnd Bergmann, J. Bruce Fields,
	Miklos Szeredi, NeilBrown, Shuah Khan, Omar Sandoval

The problem is that a pathname can contain absolute symlinks and now
they are resolved relative to the current root.

It may be a problem if you want to open a file in another namespace.
For example, you open /proc/PID/root for a process from the target
namespace and then you use openat() to open a file from this namespace.

If a path to the file contains an absolute symlink, you will open a file
from the current namespace, because a symlink will be resolved relative
to the current root.

A proposed solution adds a new flag which means that dirfd should be
set as a root for a current system call (openat(), statat(), etc).

Here are examples how we can open a file in a contex of another process.

How we can do this without these changes:

	old_root = open("/", O_PATH);
	old_cwd = open(".", O_PATH);
	chroot("/proc/PID/root");

	fd = open(pathname, O_RDONLY);

	fchdir(old_root); /* emulate fchroot() */
	chroot(".");
	fchdir(old_cwd);

	close(old_cwd);
	close(old_root);

How this code is simplified with new flags:
	dirfd = open("/proc/PID/root", O_PATH);
	fd = open(dirfd, pathname, O_RDONLY | O_ATROOT);
	close(dirfd);

One more thing is that chroot isn't available for unprivileged users.

We met this problem, when we tryed to dump an ubuntu container and
failed to resolve /proc/PID/root/var/run/mysqld/mysqld.sock, because
/var/run was a symlink to /run.

Changes since the first version:
- change a value of O_ATROOT to not intersect with other constants. 
Changes since the second version:
- initialize nd->root_seq (thanks to Omar Sandoval for reporting and
  fixing this issue)

Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: "J. Bruce Fields" <bfields@redhat.com>
Cc: Miklos Szeredi <mszeredi@redhat.com>
Cc: NeilBrown <neilb@suse.de>
Cc: Shuah Khan <shuahkh@osg.samsung.com>
Cc: Omar Sandoval <osandov@osandov.com>
Signed-off-by: Andrey Vagin <avagin@openvz.org>

Andrey Vagin (3):
  namei: add LOOKUP_DFD_ROOT to use dfd as root
  fs: allow to use dirfd as root for openat and other *at syscalls
  selftests: check O_ATROOT and AT_FDROOT flags

 fs/exec.c                                       |  4 +-
 fs/namei.c                                      | 42 +++++++++++----
 fs/open.c                                       |  6 ++-
 fs/stat.c                                       |  4 +-
 fs/utimes.c                                     |  4 +-
 include/linux/namei.h                           |  2 +
 include/uapi/asm-generic/fcntl.h                |  4 ++
 include/uapi/linux/fcntl.h                      |  1 +
 tools/testing/selftests/Makefile                |  1 +
 tools/testing/selftests/lookup/.gitignore       |  1 +
 tools/testing/selftests/lookup/Makefile         |  8 +++
 tools/testing/selftests/lookup/lookup_at_root.c | 71 +++++++++++++++++++++++++
 tools/testing/selftests/lookup/run.sh           | 14 +++++
 13 files changed, 148 insertions(+), 14 deletions(-)
 create mode 100644 tools/testing/selftests/lookup/.gitignore
 create mode 100644 tools/testing/selftests/lookup/Makefile
 create mode 100644 tools/testing/selftests/lookup/lookup_at_root.c
 create mode 100755 tools/testing/selftests/lookup/run.sh

-- 
2.5.5

^ permalink raw reply	[flat|nested] 5+ messages in thread
* Re: [PATCH 1/3] namei: add LOOKUP_DFD_ROOT to use dfd as root
@ 2016-07-02  0:55 Omar Sandoval
  2016-07-05 21:26 ` [PATCH 1/3 v2] " Andrey Vagin
  0 siblings, 1 reply; 5+ messages in thread
From: Omar Sandoval @ 2016-07-02  0:55 UTC (permalink / raw)
  To: Andrey Vagin
  Cc: linux-fsdevel, Miklos Szeredi, J. Bruce Fields, Arnd Bergmann,
	NeilBrown, containers, linux-kernel, Shuah Khan, criu,
	Eric W. Biederman, Alexander Viro

On Tue, Jun 28, 2016 at 10:38:28AM -0700, Andrey Vagin wrote:
> The problem is that a pathname can contain absolute symlinks and now
> they are resolved relative to the current root.
> 
> If we want to open a file in another mount namespaces and we have a file
> descriptor to its root directory, we probably want to resolve pathname
> in the target mount namespace. For this we add this new flag.
> 
> If LOOKUP_DFD_ROOT is set, path_init() initializes nd->root and nd->path
> to the same value.
> 
> Signed-off-by: Andrey Vagin <avagin@openvz.org>

Hi, Andrey,

Seems like a useful feature. Make sure to cc linux-api@vger.kernel.org
for new userspace interfaces. One comment on the implementation below.

> ---
>  fs/namei.c            | 12 +++++++++++-
>  include/linux/namei.h |  2 ++
>  2 files changed, 13 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/namei.c b/fs/namei.c
> index 70580ab..5f08b69 100644
> --- a/fs/namei.c
> +++ b/fs/namei.c
> @@ -2148,7 +2148,7 @@ static const char *path_init(struct nameidata *nd, unsigned flags)
>  	nd->path.dentry = NULL;
>  
>  	nd->m_seq = read_seqbegin(&mount_lock);
> -	if (*s == '/') {
> +	if (*s == '/' && !(flags & LOOKUP_DFD_ROOT)) {
>  		if (flags & LOOKUP_RCU)
>  			rcu_read_lock();
>  		set_root(nd);
> @@ -2174,6 +2174,11 @@ static const char *path_init(struct nameidata *nd, unsigned flags)
>  			get_fs_pwd(current->fs, &nd->path);
>  			nd->inode = nd->path.dentry->d_inode;
>  		}
> +		if (flags & LOOKUP_DFD_ROOT) {
> +			nd->root = nd->path;
> +			if (!(flags & LOOKUP_RCU))
> +				path_get(&nd->root);

You're not initializing nd->root_seq here. That means that if we end up
going through unlazy_walk(), we're going to call legitimize_path() (and
thus read_seqcount_retry()) with stack garbage, get a spurious ECHILD,
and do an unnecessary restart of the path lookup instead of dropping
into ref-walk mode.

> +		}
>  		return s;
>  	} else {
>  		/* Caller must check execute permissions on the starting path component */
> @@ -2202,6 +2207,11 @@ static const char *path_init(struct nameidata *nd, unsigned flags)
>  			nd->inode = nd->path.dentry->d_inode;
>  		}
>  		fdput(f);
> +		if (flags & LOOKUP_DFD_ROOT) {
> +			nd->root = nd->path;
> +			if (!(flags & LOOKUP_RCU))
> +				path_get(&nd->root);
> +		}

Same here.

The following should do the trick:

diff --git a/fs/namei.c b/fs/namei.c
index 9958b605e822..101d1fb8d3cb 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2176,7 +2176,9 @@ static const char *path_init(struct nameidata *nd, unsigned flags)
 		}
 		if (flags & LOOKUP_DFD_ROOT) {
 			nd->root = nd->path;
-			if (!(flags & LOOKUP_RCU))
+			if (flags & LOOKUP_RCU)
+				nd->root_seq = nd->seq;
+			else
 				path_get(&nd->root);
 		}
 		return s;
@@ -2209,7 +2211,9 @@ static const char *path_init(struct nameidata *nd, unsigned flags)
 		fdput(f);
 		if (flags & LOOKUP_DFD_ROOT) {
 			nd->root = nd->path;
-			if (!(flags & LOOKUP_RCU))
+			if (flags & LOOKUP_RCU)
+				nd->root_seq = nd->seq;
+			else
 				path_get(&nd->root);
 		}
 		return s;

-- 
Omar

^ permalink raw reply related	[flat|nested] 5+ messages in thread
end of thread, other threads:[~2016-07-20 20:43 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-07-20 20:42 [PATCH 0/3 v3] fs: allow to use dirfd as root for openat and other *at syscalls Andrey Vagin
2016-07-20 20:42 ` [PATCH 1/3 v2] namei: add LOOKUP_DFD_ROOT to use dfd as root Andrey Vagin
2016-07-20 20:42 ` [PATCH 2/3 v2] fs: allow to use dirfd as root for openat and other *at syscalls Andrey Vagin
2016-07-20 20:42 ` [PATCH 3/3] selftests: check O_ATROOT and AT_FDROOT flags Andrey Vagin
  -- strict thread matches above, loose matches on Subject: below --
2016-07-02  0:55 [PATCH 1/3] namei: add LOOKUP_DFD_ROOT to use dfd as root Omar Sandoval
2016-07-05 21:26 ` [PATCH 1/3 v2] " Andrey Vagin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).